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(57) Abstract 

The present invention provides a system and method of performing user authentication on web based applications, such as IBM- 
Network Siation Conliguration Preference Manager. In particular, the system and method save and continuously pass user 
(29) back and fonh between a web client (12) and a web server (16). The user infomiation (29) can then be used by CGI programs (20) 
beinc executed on the web server (16) for authentication puiposcs. Specifically, each CGI program will examme the user mformation (29). 
Uctcmine the authority privileges of the user, run the CGI program under a non-default user mode, return user mformation back to the 
web client (12). and return the CGI job to nin in a default user mode. 
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GENERIC USER AUTHENTICATION FOR 
NETWORK COMPUTERS 

FIELD OF THE INVENTION 

The present invention relates to network systems using Internet technology. 
More partioularly, the present invention relates to the authentication of users submittmg 
job requests from web clirats. 

BACKGROUND OF THE INVENTION 

A current trend in network confuting is to provide lower cost work^ticms 
without sacrificing end-user capabilities. Such wcH-k^^ons are being made avculable 
through the exploitation of the emerging Internet technologies that ccmtinue to be 
developed. In particular, new network solutions, such as IBM's Network Station, utilize 
a World Wide Web environment wherein each client workstation behaves like a Web 
client (i.e., it utilizes a Web browser) connected to an HTTP (Hj^ertext Transfer 
Protocal) server. While these new workstations typically have less computing power 
than traditicmal personal con^uters or UNIX workstations (thereby reducing cost), they 
are better equipped to take advantage of various applications on file servers such as 
IBM's AS/400, PC servers, RS/6000, System/390 etc. 

Web based applications on web s^ers are implemented through CGI (CommcHi 
Gateway Interface) programs, scripts or some other form of application program 
interface (API), such as Netscape's™ NSAPI, Microsoft's™ ISAPI, or Java's Servlet API. 
Similar to the act of retrieving HTML (Hypertext Markup Language) documents on 
web servers from web clients, CGI programs provide the means by which web clients 
can run applications in real time on web servers and receive back dynamically created 
output. CGI programs are executed each time a client requests a URL (Uniform 
Resource Locator) corr^ponding to the CGI program. A limitation involved in the 
mnning of CGI programs is the fact tfiat a web based server does not typically keep 
track or know which user is running a given CGI program. This can create potential 
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security problems, particularly in the case where it is desirous to have programs behave 
differently' depending upon the privilege level of the user. 

Accordingly, it is of particular importance with such systems that utilize Internet 
technologies to provide some means of user authentication. Unlike with existing 
terminal emulation networking, web-based systems do not necessarily know, or care to 
know, who the user is that wants to run a particular CGI program or what the user's 
level of privileges are. As noted, this can become a serious limitation if an end user is 
a systems administrator, and the end user needs to perform system configuration 
functions from a remote workstation. For example, a systems adnunistrator should be 
able to pull up non-default screens and execute protected programs not available to the 
general public. (E.g., certain menu options, such as the option to manipulate a 
password file, should not be available to every user.) 

While it is known to have CGI programs execute differently depending upon the 
user profile or ED supplied to the operating system, this obviously cannot 
accomplished unless the operating system knows the identity (and perhaps the 
password) of the end user. As noted above however, most web-based file servers 
provide no built-in system for recognizing web users. While it may be possible to ask 
for a user ID and password each time a subset of CGI programs are executed, such a 
system would create far too much overhead since the number of programs requiring 
user ID or profile checking may be extremely high. Rather, what is preferred js a 
system that keeps track of who the user is each time a CGI program is executed and 
then acts accordingly. 

Some HTTP servers are known to include processes for performing very limited 
forms of basic user authentication. These servers, however, require that the web user 
provide a password each time the client is directed to a new server. Given the number 
of servers that may be involved in a web based network, this presents serious 
limitations. Thus, a system is required that can provide user authentication over a 
complete web based network. _ 



wo 98/38759 



3 



PCT/US98/0a450 



SUMMARY OF THE INVENTION 

The present invention provides a system and method for identifyiiig and 
responding to a user*s authority level on a web based network. In a first aspect, the 
invention includes a network system having a web server, such as an HTTP server, at 
least one web client that includes a mechanism for submitting user information along 
with CGI execution requests to the web server, and at least one self authenticating CGI 
program that is initially executable under a default user mode or user ID. The CGI 
piogrmn includes a means for examining the user inforaiation, a means for determining 
the privilege level of the user, a means for causing the program to ran in a non-default 
mode, a means for storing and returning the user information back to the web client, 
and a means for returning the CGI program back to a default user mode. 

In a second aspect, the present invention provides a method of providing user 
authentication that includes the steps of providing a web server that initially extracts 
user information from the end user during a one time logon procedure. The web server 
then stores password information for the user in a security object on the web server and 
stores other user information in hidden variables and sends the user information back to 
the web client in an HTML form. All subsequent CGI execution requests from the web 
client include the following steps. First, the user information is remmed back to the 
web server with the execution request in the HTML hidden variables. Next, execution 
of the CGI program is commenced under a defauU user mode or ID on the web server. 
The user information received with the execution request is then examined and the 
authority level of the user is determined. The authority level of the user may be 
determined by obtaining password information from the security object. Next, the CGI 
program makes the appropriate system calls to cause the CGI program to run under a 
non-default user mode or ED. The user information is then again stored in HTML 
hidden variables and returned to the web client along with the results of the CGI 
program execution. Finally, the CGI program makes the appropriate system calls to 
cause the CGI program to return to execution in its default user mode. 
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Additionally, it should be recognized that this invention contemplates a network 
system having many HTTP servers, each comprising a generic or common protocol for 
implementing the herein disclosed user authentication system and method. 

5 Finally, while this disclosure focuses on an implementation using CGI programs, 

it should be recognized that the systems and methods described herein may include any 
program types that are initiated by a web server. Thus, any web server API 
(application program interface), such as Netscape's™ NSAPI, Microsoft's™ ISAPI, or 
Java's Servlet API, or any other type of web program interface type may be substituted 

10 for CGI as described herein. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 depicts a block dia^am of a web based client server network m 
accordance with a preferred embodiment of the present invention. 

FIG. 2 depicts pseudo code from a CGI program and associated subroutines in 
accordance with a preferred embodiment of the present invention. 

FIG. 3 depicts a flow diagram of a method of implementing user authentication 
in accor<^Ttc6 witfi a prefered embodiment of the present invention. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

Referring now to the figures, FIG. I dqjicts a web based client saver netwcHk 
10. Included is a file server 16 that includes an HTTP server 18, a plurality of CGI 
programs 20, a security object 22, and a storage device 21. Also shown is a web client 
12 mnning a web browser 14 that is in communication with file server 16. The 
communication link between web client 12 and file server 16 may be accomplish^ 
with any type of transmission link including ethemet, twisted pair, token ring, tel^hone 
wires, optical fibers, coaxial cable and/or a wireless transmission system. 

The network system 10 operates as follows. When a web clirat 12 seeks to 
execute a CGI program on the file server 16, it submits a CGI execution request 24 to 
the HTTP server 18. Pursuant to this invention and along with the executfcm request 
24, a set of user inforaiation 29 is also submitted that includes a user ID 13, an IP 
(Internet protocol) address 15 and an admin-user flag 17 (described below). It should 
be understood that additional user information, such as an encrypted password, part 
number, time and date inforaiation, etc., may also be included. 

When the HTTP server receives the request, it launches the execution of a 
particular CGI program 20 under a default execution profile or mode 25. The CGI 
program 20, which then begins to run under the default mode, launches a series of 
novel procedure calls that perform user authentication. The procedures include a 
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mechanism for examining the user information, a mechanism for determining the 
authority {Privilege level of the user, a mechanism for causing the CGI program to run 
under a non-default user profile 23, a mechanism for returning the user information 
back to the web client (typically with the results of the CGI execution), and a 
mechanism for returning the CGI job back to its default mode or profile 25. The code 
for running these jobs may be included in the CGI programs 20 themselves, or may be 
stored elsewhere within or near the file server 16. 



Authentication and/or authorization is thus accomplished I ) by providing a 
transparent means by which user infomiation can be continuously retrieved from and 
returned to the web browser 1 4 each time a CGI program is executed; and 2) by 
providing a means by which CGI programs can dynamically change their own 
execution profile within the server's operating system. 



In this preferred embodiment, the user infomiation 29 is transferred back and 
forth between the client 12 and server 16 using hidden codes or HTML hidden 
variables for each CGI execution. Below is an example of a piece of HTML , code that 
utilizes hidden variables within an HTML form. 



<FORM NAME="mainForm"> 

<INPUT TYPE="HIDDEN" NAME="NSM_TAG_PROD" VALUE="5733A07"> 
<INPUT TYPE="HIDDEN" NAME="NSM_TAG_NSMUSER" 
VALUE="DEVON"> 

<INPUT TYPE="HIDDEN" NAME="NSMLTAG_NSMIPADDR" 
VALUE="9.5. 100.1 09"> 

<INPUT TYPE="HIDDEN" NAME="NSM_TAG_NSMTERM" VALUE="NO"> 
<INPUT TYPE="HIDDEN" NAME="NSH_TAG_NSMADMIN" VALUE="YES"> 
<INPUT TYPE="HIDDEN" NAME="NSM_TAG_KEY" 
VALUE="855223380_50"> 

<INPUT TYPE="HIDDEN" NAME="NSM_TAG_NLV VALUE="MRI2924"> 
<INPUT TYPE="HIDDEN" NAME="NSM_TAG_SERVER" VALUE="<BASE 
HREF=http://9.5.1 5 1 .42/QIBM/NetworkStation/MRI2924/>"> 
<INPUT TYPE="H1DDEN" NAME="NSM_TAG_Af'M_INSTALL" 
VALUE="YES"> 

<INPUT TYPE="HIDDEN" NAME="NSM_TAG_NAV_INSTALL" 
VALUE="NO"> 

<INPUT TYPE="HIDDEN" NAME="NSM_TAG_NSB_INSTALL" 

VALUE="NO"> 

</FORM> 
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Hidden variables are a defuied mechanism witfiin flie HTML language that may 
be included as part of a form 19 within an HTML document Hidden variables within a 
fomi are variables that are transparent to the user under noimal viewing conditions. 
Forms are used in web-based HTML applications as one me^od for transieiring 
infomnation back and forth between a client 12 and a server 16. (Thus, forms may be 
used to extract and return information from a user to a server, such as when a user is 
prompted for information, or they may be used to return information to a user, such as 
when an HTML documents is returned to the browser 14 by a CGI program.) In tfiis 
case, hidden variables are used to send a user ID (stored in NSM_TAG_NSMUSHl) 
"DEVON," an IP address (stored in NSM_TAG_NSMAPADDR) of 9.5.100.109, an 
admin-user value (stored in NSM_TAG_NSMADMIN) of "YES,*' and a plurality of 
additional information. 

As noted above, user information 29 is uploaded to the server diH^g each CGI 
execution request 24 and returned back to the client with the results of each CGI 
program 26. Thus, because the server receives and inrunediately returns the user 
information, ttiere is generally no need to worry about long^erm storage and 
management of user information 29 on die server. On the client side however, the web 
browser 14 may include a means for storing and managing the user infonnation 29 until 
the next CGI request occurs by the browser 14. 

It should be recognized that while this preferred embodiment handles (he 
transportation of user information 29 with hidden HTML variables, any alternate means 
is likewise within the purview of this invention. For example, the transportation of user 
information could be accomplished with "Cookies" 1 1 . Cookies are nuggets of data that 
are sent to the browser 14 from a web server 16. A cookie 1 1 can contain any type of 
data. Cookies 1 1 are then returned to the server 16 if the particular link (or URL) is in 
the Cookies* database. 

While the preferred embodiment does not transfer an actual password back and 
forth between the client and server, tfiis is recognized as a possible alternate embodiment 
for this invention and is described below. The preferred embodiment operates by first 
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extracting a user password 27 and storing it in a security object 22. (Extraction is 
typically done during an initial logon procedure.) The password 27 can then be readily 
re-obtained later by the server 16 from the security object 22 based upon the user 
information 29. This implementation provides increased security since password 
information is never transmitted back to the browser 14. 

As noted, an alternate embodiment would be to include an encrypted password in 
the user information 29 that can be passed from the client 12 to the server 16. This 
would eliminate the need for the security object 22 on the server 16 since each password 
would be delivered directly to the server 16 during each CGI execution request 24. 
While this system may* be less secure, it would be less complicated to implement in a 
network that utilized a high number of servers (e.g., the world wide web). 

The mechanism for determining the authority of the end user is thus accomplished 
by first using the user ID 13 to retrieve the user's password 27 ft^m the security object 
22. This retrieval process may be initiated by a system call from within the CGI 
program 20. Witfi the password 27, the CGI program can cause the operating system to 
run the program under a non-default user profile 23. This allows the same CGI program 
to behave differently depending upon the end-user*s authority, thereby providing system 
authorization. Unique to this embodiment is the inclusion of a mechanism or system 
call from within the CGI program 20 which causes the CGI program 20 to switch the 
mode or profile from a default profile 25 to a specific user profile 23. 

The CGI programs 20 and security object 22 will typically be stored on or near 
the server in storage device 2L Storage device 21 may be any known device capable of 
storing computer readable information. Examples of storage devices include CD-ROM, 
magnetic diskettes, tapes, transnussion mediums, etc. 

This system and method is fiirther enhanced by the passing back and forth of an 
admin-user flag 17 for determining which screens to provide to the end user. For 
example, if the user is a systems administrator, screens may be downloaded to the client 
workstation that provide menu options not available to other users. If the end user 
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happens to be a systems administrator, relevant CGI programs 20 may then be exeoi^ed 
under his or her specific non-default user profile 23 (thereby allowing for remote 
configuration etc.) Once the program functions were performed, the CGI job would then 
be retumed to run under the default profile 25. 

Referring now to FIG. 2, an example of a CGI program 28 (which may be 
aninstance of the CGI programs 20 on file server 16 as shown in FIG. 1) is shown in 
pseudo code with associated procedures SWAP_PROFILE 30 and SWAPJBACK 32. 
Here it can be seen that each CGI program 28 first collects user information 29 fliat 
typically includes a user ID 13 and EP address 15 from the hidden variables in an HTML 
form 19. The program 28 then calls SWAF_PROFILE 30 which will retrieve die user's 
password 27 from the security object 22 and then cause the CGI program 28 to be 
executed under a non-defauH user profile 23. Once the body of Ac CGI program 28 is 
completed, the user ID and IP address are stored in the next HTML hidden variables 
along with an admin-user flag 17 in an HTML form, and retumed back to the user widi 
the results from the execution. Thus, a continuous means of passing user informalicm 
back and forth between the client 12 and server 16 is provided. Finally, the sub-routine 
SWAP_BACK 32 is called which changes the job back to a default user mode 25. It 
shoukl be recognized that these procedures can be readily generalized to be provide a 
generic user authentication for any file server system. 

Referring now to FIG. 3, a flow chart is shown depicting a typical method of 
implementation. First, user infomiation 29 (e.g., user ID, password, IP address) is 
extracted from an end user during a logon procedure at a client site 12. This infcmmtion 
29 is then passed to the web server 16. It is important to note that this extraction is cMily 
required a single time. Next, the password 27 is stored in a security object 22 and the 
remaining user information is placed in hidden variables in a form and sent back to the 
web client 12 for future use. From this point on, any subsequent CGI execution requests 
by a v^^b client 12 include the following steps. First, the web client 12 causes the user 
information 29 to be retumed to the web server along with any CGI execution r^iuests 
24. Upon receiving an execution request, the HTTP server 18 causes the CGI program 
to be launched under a default user mode 25 on the web server 25. The CGI program 20 
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then makes the necessary system calls to examine the user infomiation received with the 
execution request 24. From this information 29, the CGI program 20 determines the 
authority level of the user. The CGI program 20 then makes additional system calls to 
cause the HTTP server 1 8 to mn the CGI program under a non-default user mode 23 if 
appropriate (i.e., it is run under a current user id or profile of the user). Next, the CGI 
program 20 causes user information 29 to be again stored in HTML hidden variables and 
returned to the web client with the results of the execution 26. Finally, the CGI program 
makes the appropriate system calls to cause the HTTP server to return the CGI program 
back to default mode 25. These sequence of steps are thereafter repeated as mentioned 
for each subsequent CGI execution request 24. 

While the embodiments discussed above deal primarily with a traditional web- 
based network, it should be recognized that this invention has applications that are much 
more expansive. For example, this invention may cover a home security system wherein 
each client (e.g., a house alarm) may be networked to a server (e.g., a security company). 
It may cover web-tv applications, consumer electronics, and automotive systems. For 
example electronic devices may be configured to automatically browse web pages for 
warranty information. Automobiles may dial up a network to receive navigation 
information. Thus, any client-server environment that requires authorization may fall 
within the purview of this invention. 

Additionally, it should be recognized that while HTML is the industry standard 
scripting language for web systems, any known or future scripting languages nxay be 
utilized herein. Finally, the embodiments and examples set forth herein were presented 
in order to best explain the present invention and its practical application and to thereby 
enable those skilled in the art to make and use the invention. However, those skilled in 
the art will recognize that the foregoing description and examples have been presented 
for the purposes of illustration and example only. The description as set forth is not 
intended to be exhaustive or to limit the invention to the precise form disclosed. Many 
modifications and variations are possible in light of the above teaching without departing 
from the spirit and scope of the following claims. - _ - _ _ 
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ADVANTAGES 

It is therefore an advantage of the present invention to provide user authentication 
in a web based network environment. 

It is therefore a further advantage of the present invention to use an HTML form 
to pass user information back and forth between the client and the server thereby 
eh'minating the need to prompt for user information. 

It is a furtiier advantage of the present invention to provide a means by which 
CGI pro-ams can change execution modes in an HTTP server environment based on a 
privileged level of an end user. 

It is a further advant^e of the present invention to provide a security object on a 
web server for temporarily storing password information for users logged on to die 
network. 
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We claim: 

1 1 . A network having a user authentication system, said network system 

2 comprising: 

3 a web server having an operating system that executes programs under a plurality 

4 of user modes; 

5 a web client having a mechanism that submits user information along with 

6 program execution requests to said web server; and 

7 a program being initially executable under a default user mode, said program 

8 having a first mechanism that examines said user information and a second mechanism 

9 that dynamically causes said operating system on said web server to run said program 
10 under a non-default user mode, 

1 2. The network of claim 1 wherein said user information includes a user ID. 

1 3. The network of claim 1 wherein said user information includes an IP address. 

1 4. The network of claim 1 wherein said program comprises a common gateway 

2 interface. 

1 5. The network of claim 1 wherein said program further includes a system that 

2 uses said user information to determine a privilege level of the user logged onto said web 

3 client. 

1 6. The network of claim 1 wherein said program further includes a third 

2 mechanism that dynamically causes said operating system on said web server to switch 

3 said program to mn back under said default user mode. 

1 7. The network of claim 1 further comprising a system that extracts said user 

2 information from a user during a logon procedure. 

1 8. The network of claim 1 wherein said program further includes a system that 

2 returns a new set of user information to said web client. 
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1 9. The network of claim 1 wherein said program includes a w^b server 

2 application program interface. 

, 1 10. The network of claim 1 wherein said user information is stored in html hidden 

2 variables. 

« 

1 11. The network of claim 1 wherein said user information is stored in a cookie. 

1 12. The network of claim 1 wherein said user infbmmtion is transparent to the 

2 user. 

1 13. A program product comprising: 

2 a recordable media; saui 

3 a program recorded on said recordable media and being initially executable under 

4 a default user mode on an operating system running on a web based s^er, said program 

5 OTnqjrismg a first mechanism that extracts user information from a plurality of hidden 

6 variables in a first html form submitted by a web client and a second mechanism that 

7 causes said operating system to mn said program a non-default user mode. 

1 14. The program product of claim 13 further comprising a mechanism that stores 

2 user information in hidden variables in a second html form and that returns said user 

3 information to said web client. 

1 isf The program product of claim 13 further comprising a mechanism that 

2 retrieves a user password from said server based upon said user information. 

» • 

1 16. The program product of claim 13 wherein said user information includes a 

2 user ID and an IP address. 
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1 1 7. A system for identifying and responding to a user's authority level on a web- 

2 based network, said system comprising: 

3 a mechanism that sends and receives user information back and forth between a 

4 web client and a web server; 

5 a plurality of programs, said programs being stored on said web server and being 

6 initially executable under a defaiult user mode; 

7 a first subroutine callable from each of said programs, said first subroutine 

8 examines said user information sent from said web client; 

9 a second subroutine callable from each of said programs, said second subroutine 

10 uses said user information to determine the authority level of the user on said web client; 

1 1 and 

12 a third subroutine callable from each of said programs, said third subroutine uses 

13 said authority level of the user to cause each of said programs to run under a non-default 

14 user mode on said web server. 

1 18. The system of claim 17 further comprising a fourth subroutine callable from 

2 each of said programs, said fourth subroutine causes said programs to return to run under 

3 a default user mode on said web server. 

1 19. The system of claim 17 wherein said second routine includes a mechanism 

2 that retrieves a password for the user from said web server in order to detem^ne the 

3 authority level of the user. 

1 20T The system of claim 17 wherein said password is stored in a security object 

2 on said web server during a logon procedure. 

1 21. The system of claim 17 wherein said user information is stored in html 

2 hidden variables. 

1 22. The system of claim 17 wherein said user information is stored in a cookie. 
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1 23. A method of automatically authenticating a user on a web based network 

2 during tfte execution of programs on a web server when submitted from a web client, 

3 comprising the steps of. 

• 4 sending user infomiation to the web client each time a program finish^ executing 

5 on said web server; 

' 6 returning said user information from the web client to the web server during a 

7 new execution request by said web client; 

8 latmehing a new program fix>m said web server under a default user mode; 

9 examining said user information received with said executicwi request; 

10 determinkig an atitfiority level of the user based upon said user inftmaation; and 

1 1 causing the new program to be run under a non-default user mode. 

1 24. The method of claim 23 further comprising the initial one-time step of 

2 collecting user information during a logon procedia^e. 

1 25. The method of claim 23 further comprising the step of storing a user 

2 passwcwrd in a security object on said web server during said logon procedure. 

1 26. The method of claim 23 further comprising the steps of returning a new set 

2 of user infomiation to said web client. 

1 27. The method of claim 23 further comprising the step of causing the new 

2 program to run back under said default user mode. 

1 28. The method of claim 25 wherein said step of determining the authority level 

, 2 of the user based upon said user information includes the step of using said user 

3 information to retrieve said password stored in said security object. 

1 29. The method of claim 25 wherein said user information is stored in html 

2 hidden variables. 



1 



30. The method of claim 25 wherein said user information is stored in a cookie. 
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1 3 1. A method of setting the appropriate level of authority during the execution of 

2 programs initiated by a web server when requested by a web ch'ent having a user logged 

3 thereon, wherein said user has a predetermined user privilege level, said method 

4 comprising the steps of: 

5 extracting user information for said user during a logon procedure; 

6 storing said user information as html hidden variables in an html form and 

7 returning said html hidden variables to said web client; 

8 for each subsequent request by said web client to execute one of said programs, 

9 performing the steps of: 

10 sending said html hidden variables back to said web server along with said 

1 1 execution request; 

12 commencing execution of said program under a default mode; 

13 examining said user information in said html hidden variables; 

14 using said user information to determine the level of authority of the us^, 

15 dynamically causing the program to be executed under the appropriate level of 

16 user authority; 

17 storing said user information as html hidden variables in a new html form and 

18 returning said html hidden variables to said web client; and 

19 returning said program to its default mode. 

1 32. The method of claim 31 wherein said user information includes an IP 

2 address. 

1 33.* The method of claim 31 wherein said user information includes a user ID. 

1 34. The method of claim 3 1 wherein said user information includes an admin- 

2 user flag. 
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1 35. A method of automatically authenticating a user on a web based network 

2 during the execution of programs on any one of a plurality of web servers when 

3 submitted from a web client, comprising the stq>s of: 

' 4 returning user inftmnation back to the web client from one of said web servers 

5 each time a program finishes executmg a job for said web client, wh»ein said user 

6 information is stored in html hidden variables; 

7 sending said user infomiation from the web client to Ae next web server 

8 responsible for implementing the next program execution request by said web client; 

9 initiating execution of said next program from said web server und^ a default 

10 user mode; 

11 examining said* user information received with said program execution request; 

12 determining an autiiority level of the user based itpon said user infomiation; and 

13 causing the new program to be mn under a non-default user mode. 

1 36. The method of claim 35 wherein said programs include a conmion gateway 

2 interface. 

1 37. The method of claim 35 wherein said programs include an application 

2 program interface. 
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1 38. A program product^ comprising: 

2 a first plurality of hidden codes that store user information created by a browser, 

3 said first plurality of hidden codes being transmittable to a web server, 

4 a second plurality of hidden codes that store user information created by a job 

5 running on said web server, said second set of hidden codes being transmittable to said 

6 browser; and 

7 signal-bearing media bearing the first and second plurality of hidden codes. 

1 39. The program product of claim 38 wherein said first and second plurality of 

2 hidden codes reside in an html form. 

1 40. The program product of claim 38 wherein said first and second plurality of 

2 hidden codes are identical. 

1 41. The program product of claim 38 wherein said first and second plurality of 

2 hidden codes include a user ID. 

1 42. The program product of claim 38 wherein said first and second plurality of 

2 hidden codes include an IP address. 

1 43. The program product of claim 38 wherein said first and second plurality of 

2 hidden codes include an admin-user address. 
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(57) Abstract 

The present invention provides a system and method of perfonning user authentication on web based applications, such as IBM*s 
Network Station Configuration Preference Manager. In particular, the system and method save and continuously pass user information 
(29) back and forth between a web client (12) and a web server (16). The user information (29) can then be used by CGI programs (20) 
being executed on the web server (16) for authentication purposes. Specifically, each CGI program will examine the user information (29). 
determine the authority privileges of the user, run the CGI program under a non-default user mode, return user information back to the 
web client (12). and return the CGI job to run in a default user mode. 
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